Repository navigation
Include configurable token max lengths in ATM 4.3.x - #371
Merged
Merged
Conversation
Add XML docs for ATM public API (cherry picked from commit 6eaad5d)
Downgrade 4 ATM user token log messages from Error to Warning (cherry picked from commit c3b1d09)
Access, refresh and identity tokens were always checked against fixed limits (32768, 4096 and 32768 characters). Token services that issue longer tokens, such as ADFS and Entra refresh tokens or identity tokens with many claims, broke login or refresh with no way to opt in. - Add ClientCredentialsTokenManagementOptions.MaxAccessTokenLength for client credentials access tokens (token endpoint responses and cache reads) - Add UserTokenManagementOptions.MaxAccessTokenLength, MaxRefreshTokenLength and MaxIdentityTokenLength for user tokens (refresh responses and tokens read back from the authentication session) - Default every option to the existing limit, so apps that change nothing behave as before; values must be greater than zero - Add Parse and TryParse overloads that take a max length to AccessToken, RefreshToken and IdentityToken, plus IdentityToken.ParseOrDefault(string?, int), so custom IUserTokenStore implementations can honour a configured limit - Name the option to raise in the error when a token is too long; the message never includes the token value - Apply the client credentials limit when reading from HybridCache through a runtime JSON converter on a source-generated context; the cached format is unchanged (cherry picked from commit 7787219)
The cache read checked the access token against this instance's MaxAccessTokenLength. When two instances share a distributed cache with different limits, or after an operator lowers the limit, the instance with the lower limit can't read the cached entry. Its catch block then calls the token endpoint and never writes the new token back, so every call goes to the token endpoint until the old entry expires. ATM only caches a token after the token endpoint response passed the configured limit, so the cache read doesn't need to check it again. The serializer now reads the cached value without validation, and the limit applies to token endpoint responses only. (cherry picked from commit 8d63ccc)
This was referenced Oct 16, 2026
Erwinvandervalk
approved these changes
Oct 16, 2026
HybridCache returns the token to the caller and then writes it to the distributed cache in the background. The test started instance B straight after instance A returned, so on a busy CI runner B could read the shared cache before A's write landed, fetch its own token and fail. The test now waits for A's write before it starts B. (cherry picked from commit 93e2a42)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Brings #367 to 4.3.x. The fixed token length limits become options, so apps that receive larger tokens can raise them:
MaxAccessTokenLengthonClientCredentialsTokenManagementOptions, andMaxAccessTokenLength,MaxIdentityTokenLengthandMaxRefreshTokenLengthonUserTokenManagementOptions. The defaults are the old limits.AccessToken,IdentityTokenandRefreshTokengetParseandTryParseoverloads that take a max length, so customIUserTokenStoreimplementations can honour the settings. The public API only gains members.Cherry-picked both commits of #367 with
git cherry-pick -x, no conflicts. Without #369 in place, the XML doc comments inAccessToken.cs,IdentityToken.csandRefreshToken.csconflict, which is why this sits on top of it.Also includes the fix from #377, cherry-picked with
-x. The cache test from #367 raced with HybridCache's background write to the distributed cache and failed now and then on CI.Merge order: third of five, after #370. Until #369 and #370 merge, this PR also shows their commits.